You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/18 21:39:37 UTC
[I] Filter sensitive fields from Task objects in API responses (tooling-trusted-releases)
andrewmusselman opened a new issue, #701:
URL: https://github.com/apache/tooling-trusted-releases/issues/701
**ASVS:** 15.3.1 · Finding 3
**Severity:** HIGH
**CWE:** CWE-200 (Exposure of Sensitive Information)
### Description
The `TasksListResults` API response in `atr/models/api.py` (lines 449–453) returns complete `Task` SQLModel objects without field filtering:
```python
class TasksListResults(schema.Strict):
data: Sequence[sql.Task] # Full Task objects
```
Exposed fields include `task_args` (may contain secrets, file paths, internal identifiers), `error` (stack traces, implementation details), `pid` (process information), and `result` (potentially sensitive task output).
### Recommendation
1. Add "no secrets in task args" to new policy doc
2. Create an explicit `TaskPublicResponse` DTO that includes only safe fields like `id`, `task_type`, `status`, `created`, and `updated`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Filter sensitive fields from Task objects in API responses (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #701:
URL: https://github.com/apache/tooling-trusted-releases/issues/701#issuecomment-4006141032
Resolved by a2b82c024982d46aca40e9dd072c39e5e0495e81. I added documentation of our policy that secret values are not permitted as arguments to tasks. Therefore we do not need a safe wrapper of task objects.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Filter sensitive fields from Task objects in API responses (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #701: Filter sensitive fields from Task objects in API responses
URL: https://github.com/apache/tooling-trusted-releases/issues/701
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org